Unione - Email API

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:56 PM UTC
• Version: 0.1.2

Overview

The skill appears to be legitimate UniOne email API guidance, but it documents account-changing and deletion actions without consistently requiring user confirmation first.

Review this before installing if the API key can send production email or modify a real UniOne account. Use a narrowly scoped key, prefer an environment variable or secret manager over plaintext JSON, and require explicit approval for every send, create, update, subscribe, and delete action, especially event dumps, tags, projects, and webhooks.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:584

Finding

Incomplete Confirmation Controls for Destructive API Operations

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 584-602 and 646-647
Vulnerability Type: Incomplete authorization and confirmation safeguards
Risk Level: Medium

Relevant Code:

bash

# List all dumps
curl -X POST ".../event-dump/list.json?platform=openclaw" -H "X-API-KEY: $UNIONE_API_KEY" \
  -H "Content-Type: application/json" -d '{}'

# Delete a dump
curl -X POST ".../event-dump/delete.json?platform=openclaw" -H "X-API-KEY: $UNIONE_API_KEY" \
  -H "Content-Type: application/json" -d '{"dump_id": "dump-id"}'

bash

# List tags
curl -X POST ".../tag/list.json?platform=openclaw" -H "X-API-KEY: $UNIONE_API_KEY" \
  -H "Content-Type: application/json" -d '{}'

# Delete tag
curl -X POST ".../tag/delete.json?platform=openclaw" -H "X-API-KEY: $UNIONE_API_KEY" \
  -H "Content-Type: application/json" -d '{"tag_id": 123}'

The confirmation policy is narrower than the available destructive operations:

text

3. Never send an email without explicit user confirmation. Always show the recipient, subject, and body summary before executing `email/send.json`. Wait for the user to approve. This applies to every send — including test emails and retries with new content.
4. Never modify or delete templates, webhooks, or suppressions without explicit user confirmation. Show what will be changed and wait for approval.

Technical Analysis

The Skill documents authenticated deletion endpoints for event dumps and tags, but its mandatory confirmation policy only covers sending email and modifying or deleting templates, webhooks, or suppressions. Event-dump deletion and tag deletion are not included.

Because an AI agent uses these instructions as its operational policy, the omission can cause it to interpret those deletion operations as not requiring explicit approval. This is also inconsistent with the broader claim in README.md that the agent asks for confirmation before modifying ...[truncated 1306 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user confirmation before every state-changing API operation, including all create, update, set, subscribe, and delete endpoints.
2. Enumerate event-dump deletion and tag deletion explicitly in the policy rather than relying on ambiguous general language.
3. Before confirmation, display the exact endpoint, resource identifier, resource type, and expected effect.
4. Resolve and display the target resource before deletion when possible, so the user confirms a human-readable name rather than only an identifier.
5. Separate read-only operations from state-changing operations in the Skill instructions and apply a common confirmation gate to the latter.
6. Update the README security claim so it precisely matches the implemented confirmation policy.
7. Continue recommending narrowly scoped API keys to limit the impact of accidental or unauthorized operations.

T09 · Insecure Skill Coding Practices

Note

• Location: README.md:39

Finding

API Key May Be Stored in Plaintext Configuration

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 39-60
Vulnerability Type: Plaintext sensitive credential storage guidance
Risk Level: Low

Relevant Code:

json

{
  "skills": {
    "entries": {
      "unione": {
        "enabled": true,
        "apiKey": "YOUR_UNIONE_API_KEY"
      }
    }
  }
}

bash

export UNIONE_API_KEY="your-api-key-here"

Technical Analysis

The primary configuration example instructs users to place the UniOne API key directly in ~/.openclaw/openclaw.json. This can leave the credential in plaintext on disk. If that file has permissive permissions, is copied into backups, included in diagnostic archives, or read by another local process or user, the key may be disclosed.

The README offers an environment-variable alternative and recommends least-privilege keys, which partially mitigates the issue. However, it does not clearly prefer secret-backed configuration, prescribe restrictive file permissions, or explain the exposure risks of storing a production key in the JSON file.

No hardcoded real credential was found in the project, and the Skill explicitly instructs the agent not to display or log the full API key. The issue is therefore limited to insecure configuration guidance rather than embedded secret disclosure.

Attack Path

1. A user follows the README and places a production UniOne API key in ~/.openclaw/openclaw.json.
2. The configuration file is created with permissions that permit another local account or process to read it, or it is copied into an insecure backup or support bundle.
3. An attacker or unauthorized party obtains the plaintext key.
4. The party sends authenticated requests directly to the UniOne API.
5. Available operations are performed within the permissions granted to the compromised key.

Impact Assessment

A disclosed key may allow unauthorized email sending, email-address validation, access to t ...[truncated 408 chars]

Remediation

View remediation

Remediation Suggestions

1. Make a secret manager, credential store, or environment-variable reference the preferred configuration method.
2. Avoid presenting a literal API-key field in persistent JSON as the primary setup path.
3. If file-based storage is unavoidable, require restrictive permissions such as owner-only read and write access.
4. Warn users not to commit the configuration file, include it in support archives, or place it in unencrypted backups.
5. Recommend separate development and production keys with the narrowest available API scopes.
6. Document key rotation and immediate revocation procedures for suspected disclosure.
7. Ensure logs and error reports redact API headers and configuration values.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (30)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 18)May include surrounding context.

md

- **Track delivery** — set up webhooks for real-time event notifications
- **Manage suppressions** — handle bounces, unsubscribes, complaints
- **Domain management** — check DNS records, verify DKIM
- **Export analytics** — create event dumps for detailed delivery reports
- **Manage projects** — separate environments with independent API keys

## Quick Start

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 89)May include surrounding context.

md

All requests require the `UNIONE_API_KEY` environment variable. Pass it as the `X-API-KEY` header.

**Base URL:** `https://api.unione.io/en/transactional/api/v1/{method}.json?platform=openclaw`

All methods use `POST` with JSON body.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

All requests require the `UNIONE_API_KEY` environment variable. Pass it as the `X-API-KEY` header.

**Base URL:** `https://api.unione.io/en/transactional/api/v1/{method}.json?platform=openclaw`

All methods use `POST` with JSON body.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

All requests require the `UNIONE_API_KEY` environment variable. Pass it as the `X-API-KEY` header.

**Base URL:** `https://api.unione.io/en/transactional/api/v1/{method}.json?platform=openclaw`

All methods use `POST` with JSON body.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

All requests require the `UNIONE_API_KEY` environment variable. Pass it as the `X-API-KEY` header.

**Base URL:** `https://api.unione.io/en/transactional/api/v1/{method}.json?platform=openclaw`

All methods use `POST` with JSON body.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

All requests require the `UNIONE_API_KEY` environment variable. Pass it as the `X-API-KEY` header.

**Base URL:** `https://api.unione.io/en/transactional/api/v1/{method}.json?platform=openclaw`

All methods use `POST` with JSON body.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md

All requests require the `UNIONE_API_KEY` environment variable. Pass it as the `X-API-KEY` header.

**Base URL:** `https://api.unione.io/en/transactional/api/v1/{method}.json?platform=openclaw`

All methods use `POST` with JSON body.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

md

All requests require the `UNIONE_API_KEY` environment variable. Pass it as the `X-API-KEY` header.

**Base URL:** `https://api.unione.io/en/transactional/api/v1/{method}.json?platform=openclaw`

All methods use `POST` with JSON body.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

md

All requests require the `UNIONE_API_KEY` environment variable. Pass it as the `X-API-KEY` header.

**Base URL:** `https://api.unione.io/en/transactional/api/v1/{method}.json?platform=openclaw`

All methods use `POST` with JSON body.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

md

All requests require the `UNIONE_API_KEY` environment variable. Pass it as the `X-API-KEY` header.

**Base URL:** `https://api.unione.io/en/transactional/api/v1/{method}.json?platform=openclaw`

All methods use `POST` with JSON body.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

md

All requests require the `UNIONE_API_KEY` environment variable. Pass it as the `X-API-KEY` header.

**Base URL:** `https://api.unione.io/en/transactional/api/v1/{method}.json?platform=openclaw`

All methods use `POST` with JSON body.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 284)May include surrounding context.

md

All requests require the `UNIONE_API_KEY` environment variable. Pass it as the `X-API-KEY` header.

**Base URL:** `https://api.unione.io/en/transactional/api/v1/{method}.json?platform=openclaw`

All methods use `POST` with JSON body.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 351)May include surrounding context.

md

All requests require the `UNIONE_API_KEY` environment variable. Pass it as the `X-API-KEY` header.

**Base URL:** `https://api.unione.io/en/transactional/api/v1/{method}.json?platform=openclaw`

All methods use `POST` with JSON body.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 376)May include surrounding context.

md

All requests require the `UNIONE_API_KEY` environment variable. Pass it as the `X-API-KEY` header.

**Base URL:** `https://api.unione.io/en/transactional/api/v1/{method}.json?platform=openclaw`

All methods use `POST` with JSON body.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 407)May include surrounding context.

md

All requests require the `UNIONE_API_KEY` environment variable. Pass it as the `X-API-KEY` header.

**Base URL:** `https://api.unione.io/en/transactional/api/v1/{method}.json?platform=openclaw`

All methods use `POST` with JSON body.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 435)May include surrounding context.

md

All requests require the `UNIONE_API_KEY` environment variable. Pass it as the `X-API-KEY` header.

**Base URL:** `https://api.unione.io/en/transactional/api/v1/{method}.json?platform=openclaw`

All methods use `POST` with JSON body.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 460)May include surrounding context.

md

All requests require the `UNIONE_API_KEY` environment variable. Pass it as the `X-API-KEY` header.

**Base URL:** `https://api.unione.io/en/transactional/api/v1/{method}.json?platform=openclaw`

All methods use `POST` with JSON body.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 469)May include surrounding context.

md

All requests require the `UNIONE_API_KEY` environment variable. Pass it as the `X-API-KEY` header.

**Base URL:** `https://api.unione.io/en/transactional/api/v1/{method}.json?platform=openclaw`

All methods use `POST` with JSON body.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 478)May include surrounding context.

md

All requests require the `UNIONE_API_KEY` environment variable. Pass it as the `X-API-KEY` header.

**Base URL:** `https://api.unione.io/en/transactional/api/v1/{method}.json?platform=openclaw`

All methods use `POST` with JSON body.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 493)May include surrounding context.

md

All requests require the `UNIONE_API_KEY` environment variable. Pass it as the `X-API-KEY` header.

**Base URL:** `https://api.unione.io/en/transactional/api/v1/{method}.json?platform=openclaw`

All methods use `POST` with JSON body.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 510)May include surrounding context.

md

All requests require the `UNIONE_API_KEY` environment variable. Pass it as the `X-API-KEY` header.

**Base URL:** `https://api.unione.io/en/transactional/api/v1/{method}.json?platform=openclaw`

All methods use `POST` with JSON body.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 535)May include surrounding context.

md

All requests require the `UNIONE_API_KEY` environment variable. Pass it as the `X-API-KEY` header.

**Base URL:** `https://api.unione.io/en/transactional/api/v1/{method}.json?platform=openclaw`

All methods use `POST` with JSON body.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

Step 1: Get DNS Record Values — domain/get-dns-records.json

bash

curl -X POST "https://api.unione.io/en/transactional/api/v1/domain/get-dns-records.json?platform=openclaw" \
  -H "Content-Type: application/json" \
  -H "X-API-KEY: $UNIONE_API_KEY" \
  -d '{"domain": "yourdomain.com"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

After the user has added DNS records:

bash

curl -X POST "https://api.unione.io/en/transactional/api/v1/domain/validate-verification.json?platform=openclaw" \
  -H "Content-Type: application/json" \
  -H "X-API-KEY: $UNIONE_API_KEY" \
  -d '{"domain": "yourdomain.com"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

Send a transactional or marketing email to one or more recipients. Supports personalization via substitutions, templates, attachments, tracking, and metadata.

curl

bash

curl -X POST "https://api.unione.io/en/transactional/api/v1/email/send.json?platform=openclaw" \

Static analysis

No suspicious patterns detected.